hw/s390x/ipl: Set IPIB flags for secure IPL
If `-M secure-boot=on` is specified on the command line option, indicating true secure IPL enabled, set Secure-IPL bit and IPL-Information-Report bit on in IPIB Flags field, and trigger true secure IPL in the S390 BIOS. Any error that occurs during true secure IPL will cause the IPL to terminate. Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com> Reviewed-by: Thomas Huth <thuth@redhat.com> Reviewed-by: Collin Walling <walling@linux.ibm.com> Link: https://lore.kernel.org/qemu-devel/20260730214624.2328883-29-zycai@linux.ibm.com Signed-off-by: Eric Farman <farman@linux.ibm.com>
Zhuoying Cai committed
Jul 30, 2026 at 17:46 UTC
90434b7522dc79dcf0edfa146d426c1c92f85494
1 file changed
+23
-5
hw/s390x/ipl.c
+23
-5
@@ -468,15 +468,30 @@ static bool s390_has_certificate(void)
468
return ipl->cert_store.count > 0;
469
}
470
471
+static bool s390_secure_boot_enabled(void)
472
+{
473
+ return S390_CCW_MACHINE(qdev_get_machine())->secure_boot;
474
+}
475
+
476
static void s390_set_secure_boot_flags(IplParameterBlock *iplb,
472
- bool audit_mode)
477
+ bool secure_boot, bool audit_mode)
478
{
474
- if (!audit_mode) {
479
+ if (!secure_boot && !audit_mode) {
480
return;
481
}
482
483
/*
479
- * For audit mode, enable the IPL Information
484
+ * If secure-boot is enabled, then toggle the secure IPL flags (SIPL) to
485
+ * trigger secure boot in the s390 BIOS.
486
+ *
487
+ * Boot process will terminate if any error occurs during secure boot.
488
+ */
489
+ if (secure_boot) {
490
+ iplb->hdr_flags |= DIAG308_IPIB_FLAGS_SIPL;
491
+ }
492
+
493
+ /*
494
+ * For both secure boot and audit mode, enable the IPL Information
495
* Report (IPLIR) flag so that the firmware generates an IPL
496
* Information Report Block (IIRB).
497
*
@@ -545,7 +560,8 @@ static bool s390_build_iplb(DeviceState *dev_st, IplParameterBlock *iplb)
560
s390_ipl_convert_loadparm((char *)lp, iplb->loadparm);
561
iplb->flags |= DIAG308_FLAGS_LP_VALID;
562
548
- s390_set_secure_boot_flags(iplb, s390_has_certificate());
563
+ s390_set_secure_boot_flags(iplb, s390_secure_boot_enabled(),
564
+ s390_has_certificate());
565
566
return true;
567
}
@@ -699,7 +715,9 @@ void s390_ipl_update_diag308(IplParameterBlock *iplb)
715
* The kernel does not preserve secure boot flags across a reboot.
716
* Re-apply them here based on the current machine configuration.
717
*/
702
- s390_set_secure_boot_flags(&ipl->iplb, s390_has_certificate());
718
+ s390_set_secure_boot_flags(&ipl->iplb,
719
+ s390_secure_boot_enabled(),
720
+ s390_has_certificate());
721
}
722
723
update_machine_ipl_properties(iplb);